lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <4C64ACB2.3090600@hp.com> Date: Thu, 12 Aug 2010 22:23:46 -0400 From: Brian Haley <brian.haley@...com> To: Steve Chen <schen@...sta.com> CC: usagi-users-ctl@...linux-ipv6.org, netdev@...r.kernel.org Subject: Re: TAHI CN-6-4-1 failed on Linux 2.6.32 kernel On 08/12/2010 07:04 PM, Steve Chen wrote: > On Thu, Aug 12, 2010 at 4:10 PM, Brian Haley <brian.haley@...com> wrote: >> Hi Steve, >> >> On 07/28/2010 11:20 PM, Steve Chen wrote: >>> Hello, >>> >>> The TAHI correspondent node tests CN-6-4-1 (Processing in upper layer >>> - Echo Checksum) failed for me in the 2.6.32 kernel. It appears that >>> the Linux kernel is replying the ICMP echo request in >>> icmpv6_echo_reply without much checking. Is this an intentional >>> non-conformance to RFC3775 section 9.3.1? >> >> Sorry for the late reply. I've run these tests in the past against >> SLES11 (2.6.27 ?) back in January 2009 and this one passed from looking >> at my logs. I don't have that system around anymore to check the config, >> etc. I didn't see any obvious commit that would have broken it from a >> quick look, do you have a test setup to do some debugging? It will >> take a little time for me to re-configure mine to run this test. > > Brian, > > I'm using mip6d from git://www.umip.org/git/umip.git commit id > d1c240f3deb690af902ce1ff128780551ff6141c. Is that the correct version > to use? Looking at the kernel code again, the checksum error should > have been caught in icmpv6_rcv. There are probably something wrong > with my setup. I'll dig around a bit more. The system has long since been dismantled, so I'm not sure what version of mip6d I used. Yes, icmpv6_rcv() does check for checksum errors, it would be good to print-out three addresses to see which one is which, in case they weren't swapped correctly or something. It would be good to know what value skb->ip_summed was too, as a start. > Tests 5-3-1 to 5-3-6 also failed for me. Did they pass for you? I had no failures, but 5 warnings (2-1-6, 2-3-11, 4-7-1, 5-4-2, and 6-3-1). I'll see if I can get a CN test run done on my current config. -Brian -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists